@every-app/sdk 0.3.0-rc.1 → 0.3.0-rc.10

package/dist/server/integrationFetch.js

@@ -1,33 +1,14 @@
-import { CATALOG, ConfigurationError, GATEWAY_ERROR_HEADER, INTEGRATION_PROXY_PREFIX, OAUTH_TOKEN_BODY_LIMIT, allowedScopes, apiKeyHosts, authorizationFor, capabilitySettings, carriesToken, declaredScopeSets, describeTokenEndpoints, devProviderFile, grantedScopes, injectClientCredentials, integrationProxyPath, oauthClientCredentials, oauthClientOrigin, requestedScopes, requestedTokenScopes, resolveDevProvider, rewriteTokenRequestScope, scopeExcess, tokenEndpointFor, tokenGrantType, EMAIL_SENDERS_ENV, chooseEmailProvider, parseEmailList, parseEmailSender, } from "../internal/index.js";
-import { applyAttribution, checkAttribution, } from "./attribution.js";
-import { BINDING_ORIGIN, streamingRequest, } from "./gatewayFetch.js";
-/**
- * A `fetch` for one of the gateway's capabilities. Call the provider's real
- * URLs (`https://api.dataforseo.com/v3/…`); this sends them over the
- * AppGateway binding, which checks the app's manifest lists the capability,
- * injects the key the gateway holds and forwards the call. The app never
- * sees the key. A refusal the gateway makes itself comes back as a response
- * {@link gatewayRefusal} recognizes; anything else is the provider's answer.
- *
- * For an OAuth client (`linkedin`, `mastodon`, ...) it reaches the
- * provider's token endpoints only, and the gateway puts its client on the
- * request: send the code (or refresh token) without `client_id` or
- * `client_secret`. Build the authorize URL with {@link authorizeUrl} from
- * {@link integrationStatus}, and call the provider's API with the user's
- * token directly.
- *
- * In local dev only, with no binding, the developer's own key or client
- * from `.dev.vars` reaches the provider directly, under the gateway's names:
- * a catalog provider's from the catalog, a provider registered on the
- * gateway from its spec in `.everyapp/providers/<id>.json` (`everyapp
- * provider show <id> --save` writes it), put on the call as the gateway's
- * spec says.
- */
-export function integrationFetch({ env, provider, for: target, }) {
+import { ACCOUNT_HEADER, CATALOG, ConfigurationError, GATEWAY_ERROR_HEADER, INTEGRATION_PROXY_PREFIX, OAUTH_TOKEN_BODY_LIMIT, allowedScopes, apiKeyHosts, authorizationFor, capabilitySettings, carriesToken, declaredScopeSets, describeTokenEndpoints, devProviderFile, grantedScopes, heldTokenCallAllowed, injectClientCredentials, integrationProxyPath, oauthClientCredentials, oauthReadMethods, oauthWriteMethods, providerSettingPrefix, requestedScopes, requestedTokenScopes, resolveDevProvider, rewriteTokenRequestScope, scopeExcess, tokenEndpointFor, tokenGrantType, EMAIL_SENDERS_ENV, chooseEmailProvider, parseEmailList, parseEmailSender, } from "../internal/index.js";
+import { applyAttribution, attributionFor, } from "./attribution.js";
+import { BINDING_ORIGIN, gatewayBinding, streamingRequest, } from "./gatewayFetch.js";
+export function integrationFetch({ env, provider, for: explicitTarget, account, optional = false, }) {
     const catalogEntry = fetchableCapability(provider);
-    checkAttribution(env, target, `integrationFetch("${provider}")`);
+    const what = `integrationFetch("${provider}")`;
+    // Checked now, so a call nobody's fails where the fetch is made; and
+    // again per call, where an identity may since have neared its expiry.
+    attributionFor(env, explicitTarget, what);
     const values = env;
-    const binding = values["EVERY_APP_GATEWAY"];
+    const binding = gatewayBinding(env);
     if (binding && typeof binding.fetch !== "function") {
         throw new ConfigurationError("EVERY_APP_GATEWAY is configured but is not a valid service binding.");
     }
@@ -36,10 +17,28 @@ export function integrationFetch({ env, provider, for: target, }) {
     const integration = catalogEntry ??
         (binding ? undefined : devRegisteredProvider(provider, values));
     const local = binding || !integration ? null : localCredentials(integration, values);
-    if (!binding && !local && integration) {
-        throw new ConfigurationError(`${integration.label} is unavailable: deploy with the EVERY_APP_GATEWAY binding, or set ${capabilitySettings(integration).join(", ")} in .dev.vars for local development.`);
+    // In dev an OAuth provider with a held token in `.dev.vars` serves API
+    // calls without the client (the token stands in for a connection).
+    const devToken = !binding && integration?.mode === "oauth_client" && integration.flow
+        ? stringValue(values[devAccessTokenName(provider)])
+        : undefined;
+    // An OAuth provider with a Gateway-owned flow answers an API call
+    // without the client (`integration_not_connected`, below); a token
+    // endpoint call without the client throws when it is made.
+    const decidesLater = integration?.mode === "oauth_client" && integration.flow !== undefined;
+    if (!binding && !local && !devToken && integration && !decidesLater) {
+        if (optional)
+            return null;
+        const names = [
+            ...capabilitySettings(integration),
+            ...(integration.mode === "oauth_client" && integration.flow
+                ? [devAccessTokenName(provider)]
+                : []),
+        ];
+        throw new ConfigurationError(`${integration.label} is unavailable: deploy with the EVERY_APP_GATEWAY binding, or set ${names.join(", ")} in .dev.vars for local development.`);
     }
     return async (input, init) => {
+        const target = attributionFor(env, explicitTarget, what);
         const outbound = new Request(input, init);
         const upstream = new URL(outbound.url);
         const headers = new Headers(outbound.headers);
@@ -55,6 +54,30 @@ export function integrationFetch({ env, provider, for: target, }) {
             return binding.fetch(streamingRequest(`${BINDING_ORIGIN}${integrationProxyPath(provider, upstream)}`, outbound, headers));
         }
         if (integration.mode === "oauth_client") {
+            // A call to the provider's API with the token the gateway holds
+            // (docs/design/2026-10-oauth-providers.md section 7), for an entry
+            // that supports the Gateway-owned flow; a token endpoint stays the
+            // app-driven call it always was.
+            const toApi = integration.flow !== undefined &&
+                upstream.protocol === "https:" &&
+                integration.api.includes(upstream.host) &&
+                !tokenEndpointFor(integration, upstream);
+            if (toApi) {
+                if (binding) {
+                    if (account)
+                        headers.set(ACCOUNT_HEADER, account);
+                    applyAttribution(headers, target);
+                    return binding.fetch(streamingRequest(`${BINDING_ORIGIN}${integrationProxyPath(provider, upstream)}`, outbound, headers));
+                }
+                return devHeldTokenCall({
+                    provider,
+                    capability: integration,
+                    outbound,
+                    upstream,
+                    headers,
+                    values,
+                });
+            }
             return oauthClientCall({
                 provider: provider,
                 capability: integration,
@@ -92,6 +115,93 @@ export function integrationFetch({ env, provider, for: target, }) {
         return fetch(streamingRequest(upstream.toString(), outbound, headers));
     };
 }
+/**
+ * The `.dev.vars` name of a held token for `provider` in local dev
+ * (`GOOGLE_WORKSPACE_ACCESS_TOKEN`, `GITHUB_ACCESS_TOKEN`): a token the
+ * developer obtained themselves, standing in for the connection the
+ * gateway would hold. Dev-only: the gateway never reads it.
+ */
+export function devAccessTokenName(provider) {
+    return `${providerSettingPrefix(provider)}ACCESS_TOKEN`;
+}
+/**
+ * An app's call to an OAuth provider's API in local dev, with no
+ * gateway: the gateway's held-token checks in its order (the app's
+ * declared sets, the method, the route), then the developer's own token
+ * from `.dev.vars` as the bearer, straight to the provider.
+ */
+async function devHeldTokenCall({ provider, capability, outbound, upstream, headers, values, }) {
+    const token = stringValue(values[devAccessTokenName(provider)]);
+    if (!token) {
+        return devRefusal(409, "integration_not_connected", `${capability.label} isn't connected here. In local dev, set ${devAccessTokenName(provider)} in .dev.vars to a token you obtained yourself; deployed, the person connects at /connect/${provider}.`, { connectPath: `/connect/${provider}`, reconnect: false });
+    }
+    const policy = capability.scopePolicy;
+    const grant = policy
+        ? devScopeSets(policy, provider, capability.label, values, "any")
+        : null;
+    if (grant && "problem" in grant) {
+        return devRefusal(403, grant.code, grant.problem);
+    }
+    const method = outbound.method.toUpperCase();
+    const reads = oauthReadMethods(capability).includes(method);
+    const writes = !reads &&
+        capability.access.includes("write") &&
+        oauthWriteMethods(capability).includes(method) &&
+        devDeclaredAccess(provider, values) === "write";
+    if (policy && grant) {
+        const allowed = heldTokenCallAllowed({
+            policy,
+            declaredSets: grant.sets,
+            // The developer's token stands for a connection granted every set.
+            connectionSets: grant.sets,
+            hosts: capability.api,
+            method,
+            upstream,
+            readMethods: oauthReadMethods(capability),
+            writes,
+        });
+        if (!allowed.ok) {
+            const status = {
+                integration_not_connected: 409,
+                integration_method_not_allowed: 405,
+                integration_scope_not_allowed: 403,
+            }[allowed.code];
+            return devRefusal(status, allowed.code, allowed.code === "integration_not_connected"
+                ? `${capability.label} is connected without ${allowed.missingSets.join(", ")}.`
+                : allowed.message);
+        }
+    }
+    else if (!reads && !writes) {
+        return devRefusal(405, "integration_method_not_allowed", `${capability.label} calls may use ${oauthReadMethods(capability).join(" or ")} with access: "read"; ${method} needs access: "write" in the app's capabilities entry, on a provider that offers it.`);
+    }
+    applyAttribution(headers, undefined);
+    headers.set("authorization", `Bearer ${token}`);
+    for (const name of ["access_token", "token"]) {
+        upstream.searchParams.delete(name);
+    }
+    headers.delete("x-http-method-override");
+    return fetch(new Request(upstream.toString(), {
+        method,
+        headers,
+        body: method === "GET" || method === "HEAD" ? null : outbound.body,
+        signal: outbound.signal,
+        // As the gateway: the token never follows a redirect.
+        redirect: "manual",
+        ...(method === "GET" || method === "HEAD" ? {} : { duplex: "half" }),
+    }));
+}
+/** The `access` the manifest entry for `provider` declares in dev (EVERYAPP_DEV_CAPABILITIES), or null. */
+function devDeclaredAccess(provider, values) {
+    const raw = values["EVERYAPP_DEV_CAPABILITIES"];
+    try {
+        const capabilities = typeof raw === "string" ? jsonRecord(JSON.parse(raw)) : undefined;
+        const entry = jsonRecord(capabilities?.[provider]);
+        return typeof entry?.["access"] === "string" ? entry["access"] : null;
+    }
+    catch {
+        return null;
+    }
+}
 /**
  * The developer's own key or client from `.dev.vars` (with EVERYAPP_DEV
  * set), under the gateway's names; null until every setting it needs is.
@@ -110,12 +220,7 @@ function localCredentials(integration, values) {
  * with the developer's client put on it by the gateway's own rule.
  */
 async function oauthClientCall({ provider, capability, outbound, upstream, headers, values, binding, target, client, }) {
-    // With the binding the gateway resolves the provider's origin (Mastodon's
-    // instance) and refuses any other, so any origin stands in for it here.
-    const settings = binding && capability.hostSetting
-        ? { [capability.hostSetting]: upstream.origin }
-        : values;
-    const endpoint = tokenEndpointFor(capability, upstream, settings);
+    const endpoint = tokenEndpointFor(capability, upstream);
     const method = outbound.method.toUpperCase();
     if (!endpoint || !endpoint.methods.includes(method)) {
         throw new TypeError(`integrationFetch("${provider}") only reaches ${capability.label}'s token endpoints (${describeTokenEndpoints(capability)}), not ${method} ${upstream.origin}${upstream.pathname}. Call its API with the user's token directly.`);
@@ -125,6 +230,9 @@ async function oauthClientCall({ provider, capability, outbound, upstream, heade
         return binding.fetch(streamingRequest(`${BINDING_ORIGIN}${integrationProxyPath(provider, upstream)}`, outbound, headers));
     }
     applyAttribution(headers, undefined);
+    if (!client) {
+        throw new ConfigurationError(`${capability.label}'s token endpoints need the client in .dev.vars for local development: set ${capabilitySettings(capability).join(", ")}.`);
+    }
     // The gateway's scope checks, in its order, answering its refusals: an
     // app sees in `everyapp dev` what the gateway will say.
     const policy = capability.scopePolicy;
@@ -173,13 +281,15 @@ async function oauthClientCall({ provider, capability, outbound, upstream, heade
  * `x-everyapp-error`) from the local-dev twin, so {@link gatewayRefusal}
  * reads it the same way.
  */
-function devRefusal(status, code, message) {
+function devRefusal(status, code, message, extra = {}) {
     const labels = {
         400: "Bad Request",
         403: "Forbidden",
+        405: "Method Not Allowed",
+        409: "Conflict",
         502: "Bad Gateway",
     };
-    return Response.json({ error: labels[status] ?? "Error", code, message }, { status, headers: { [GATEWAY_ERROR_HEADER]: code } });
+    return Response.json({ error: labels[status] ?? "Error", code, message, ...extra }, { status, headers: { [GATEWAY_ERROR_HEADER]: code } });
 }
 /**
  * The scope sets the manifest declares for `id`, read from
@@ -191,7 +301,9 @@ function devRefusal(status, code, message) {
  * doesn't offer). Fails closed like the gateway: a hand-rolled dev harness
  * that passes no capabilities gets nothing.
  */
-function devScopeSets(policy, id, label, values) {
+function devScopeSets(policy, id, label, values, 
+/** The grant the entry needs: `write` for a token-endpoint call (the app-driven flow), `any` for a held-token call. */
+grant = "write") {
     const offered = Object.keys(policy.sets).join(", ");
     const raw = values["EVERYAPP_DEV_CAPABILITIES"];
     let capabilities;
@@ -211,11 +323,16 @@ function devScopeSets(policy, id, label, values) {
     const entry = Object.hasOwn(capabilities, id)
         ? jsonRecord(capabilities[id])
         : undefined;
-    // The gateway's check 2: listing the client for writing is the grant.
-    if (entry?.["access"] !== "write") {
+    // The gateway's check 2: listing the client for writing is the grant
+    // of the app-driven flow; a held-token call takes any listing.
+    const access = entry?.["access"];
+    if (!entry ||
+        (grant === "write"
+            ? access !== "write"
+            : access !== "read" && access !== "write")) {
         return {
             code: "capability_not_requested",
-            problem: `This app doesn't list ${label} in its capabilities. Add capabilities: { ${JSON.stringify(id)}: { access: "write" } } to everyapp.config.ts and start everyapp dev again.`,
+            problem: `This app doesn't list ${label} in its capabilities. Add capabilities: { ${JSON.stringify(id)}: { access: "${grant === "write" ? "write" : "read"}" } } to everyapp.config.ts and start everyapp dev again.`,
         };
     }
     const sets = declaredScopeSets(policy, entry);
@@ -315,6 +432,8 @@ async function checkTokenResponse(policy, capability, sets, response) {
             google: "Ask for only the scopes integrationStatus() returns, without include_granted_scopes, and connect again; if the app needs more, add the scope set to everyapp.config.ts and deploy.",
             microsoft: "On a shared Microsoft client a token carries everything the person consented to this client: have them remove this app's consent at https://myapplications.microsoft.com and connect again, or add the scope set to everyapp.config.ts and deploy.",
             slack: "Slack scopes add up per workspace installation: reinstall the app in the workspace with only the status's scopes, or add the scope set to everyapp.config.ts and deploy.",
+            space: "Ask for only the scopes integrationStatus() returns and connect again, or add the scope set to everyapp.config.ts and deploy.",
+            comma: "Ask for only the scopes integrationStatus() returns and connect again, or add the scope set to everyapp.config.ts and deploy.",
         }[policy.dialect];
         return devRefusal(403, "integration_scope_exceeded", `${capability.label} granted scopes this app doesn't declare: ${excess.join(", ")}. It declares ${sets.join(", ")} (${requestedScopes(policy, sets).scopes.join(", ")}). Nothing was passed on. ${remedy}`);
     }
@@ -333,6 +452,9 @@ function devRegisteredProvider(provider, values) {
     const resolved = resolveDevProvider(values, provider);
     if (!resolved.found)
         throw new ConfigurationError(resolved.problem);
+    if (resolved.capability.mode === "ai") {
+        throw new ConfigurationError(`${provider} is an AI provider: list it under providers and call it with createGatewayFetch(), not integrationFetch().`);
+    }
     return resolved.capability;
 }
 /**
@@ -361,9 +483,48 @@ function stringValue(value) {
  * set up") up front instead of failing mid-task. An OAuth client's status
  * carries its public `clientId` for the authorize URL.
  */
-export async function integrationStatus({ env, provider, }) {
+export async function integrationStatus({ env, provider, for: explicitTarget, }) {
+    const status = await readIntegrationStatus({
+        env,
+        provider,
+        ...(explicitTarget === undefined ? {} : { for: explicitTarget }),
+    });
+    return withSetup(status, String(provider), env);
+}
+/**
+ * `status` with its setup fields: the Gateway's as it sent them, or in
+ * local development (no binding) the `.dev.vars` names a status that
+ * isn't configured lacks.
+ */
+function withSetup(status, provider, values) {
+    const binding = gatewayBinding(values);
+    if (binding || !status.requested || status.configured) {
+        return {
+            ...status,
+            settings: Array.isArray(status.settings) ? status.settings : [],
+            setup: typeof status.setup === "string" ? status.setup : null,
+            command: typeof status.command === "string" ? status.command : null,
+        };
+    }
+    const integration = CATALOG.get(provider) ?? devRegisteredProvider(provider, values);
+    const settings = provider === "email"
+        ? ["EMAIL_FROM"]
+        : integration
+            ? [...capabilitySettings(integration)]
+            : [];
+    return {
+        ...status,
+        settings,
+        setup: settings.length
+            ? `${integration?.label ?? provider} isn't set up for local development: set ${settings.join(" and ")} in .dev.vars.`
+            : `${integration?.label ?? provider} isn't set up for local development.`,
+        command: null,
+    };
+}
+async function readIntegrationStatus({ env, provider, for: explicitTarget, }) {
+    const target = attributionFor(env, explicitTarget, `integrationStatus("${String(provider)}")`);
     const values = env;
-    const binding = values["EVERY_APP_GATEWAY"];
+    const binding = gatewayBinding(env);
     // A provider registered on the gateway is the gateway's to answer for;
     // without one, the catalog, or in local dev the row's spec from
     // `.everyapp/providers/<id>.json`.
@@ -389,7 +550,18 @@ export async function integrationStatus({ env, provider, }) {
             ready: false,
         });
     if (binding && typeof binding.fetch === "function") {
-        const response = await binding.fetch(`${BINDING_ORIGIN}${INTEGRATION_PROXY_PREFIX}/${provider}`);
+        const statusUrl = `${BINDING_ORIGIN}${INTEGRATION_PROXY_PREFIX}/${provider}`;
+        let response;
+        if (target === undefined) {
+            response = await binding.fetch(statusUrl);
+        }
+        else {
+            // Whose status: the person's identity (their OAuth connection) or the
+            // organization's, as a call would carry it.
+            const headers = new Headers();
+            applyAttribution(headers, target);
+            response = await binding.fetch(statusUrl, { headers });
+        }
         if (!response.ok)
             return unavailable();
         return (await response.json());
@@ -429,11 +601,32 @@ function devOAuthClientStatus(id, capability, values) {
     const client = values["EVERYAPP_DEV"]
         ? oauthClientCredentials(capability, values)
         : null;
-    const origin = oauthClientOrigin(capability, values);
     const policy = capability.scopePolicy;
+    // An entry with a Gateway-owned flow is listed for reading or writing;
+    // the app-driven flow alone needs the write grant.
     const grant = policy
-        ? devScopeSets(policy, id, capability.label, values)
+        ? devScopeSets(policy, id, capability.label, values, capability.flow ? "any" : "write")
         : null;
+    // The Gateway-owned flow's fields, in dev: a token in `.dev.vars`
+    // stands for a connection granted every declared set.
+    const flow = capability.flow ? "both" : "app";
+    const devToken = capability.flow
+        ? stringValue(values[devAccessTokenName(id)])
+        : undefined;
+    const gateway = (sets) => capability.flow
+        ? {
+            flow,
+            connectPath: `/connect/${id}`,
+            connection: devToken
+                ? {
+                    account: "user",
+                    label: devAccessTokenName(id),
+                    scopeSets: sets,
+                    ready: true,
+                }
+                : null,
+        }
+        : { flow };
     if (grant && "problem" in grant) {
         if (grant.code === "capability_not_requested") {
             return { requested: false, configured: false, ready: false };
@@ -443,16 +636,16 @@ function devOAuthClientStatus(id, capability, values) {
             configured: Boolean(client),
             ready: false,
             scopeSets: [],
+            ...gateway([]),
         };
     }
     const asked = policy && grant ? requestedScopes(policy, grant.sets) : null;
     return {
         requested: true,
         configured: Boolean(client),
-        ready: Boolean(client),
+        ready: Boolean(client) || Boolean(devToken),
         ...(client ? { clientId: client.clientId } : {}),
-        ...(client && origin ? { origin } : {}),
-        ...(client && grant && asked
+        ...((client || devToken) && grant && asked
             ? {
                 scopeSets: grant.sets,
                 scopes: asked.scopes,
@@ -461,6 +654,7 @@ function devOAuthClientStatus(id, capability, values) {
                     : {}),
             }
             : {}),
+        ...gateway(grant?.sets ?? []),
     };
 }
 /**
@@ -492,35 +686,3 @@ function devEmailStatus(values) {
         provider: configured && choice.ok ? choice.provider : null,
     };
 }
-/**
- * A refusal the AppGateway binding made, thrown: what `sendEmail()` throws
- * when the gateway won't send (`email_sender_not_allowed`,
- * `email_budget_exhausted`, ...). The thrown twin of {@link gatewayRefusal}.
- */
-export class GatewayRefusalError extends Error {
-    status;
-    code;
-    constructor({ status, code, message }) {
-        super(message);
-        this.name = "GatewayRefusalError";
-        this.status = status;
-        this.code = code;
-    }
-}
-/**
- * The gateway's own refusal in `response`, or null when the response is the
- * provider's answer (which may be an error of its own). Reads the body only
- * for a refusal, so call it before reading the body yourself.
- */
-export async function gatewayRefusal(response) {
-    const code = response.headers.get(GATEWAY_ERROR_HEADER);
-    if (!code)
-        return null;
-    const body = await response.json().catch(() => null);
-    const message = body &&
-        typeof body === "object" &&
-        typeof body.message === "string"
-        ? body.message
-        : `The Every App gateway refused the call (${code}).`;
-    return { status: response.status, code, message };
-}

package/dist/server/listMembers.d.ts

@@ -28,5 +28,5 @@ export interface ListMembersOptions {
  * for a request answers its signed-in user alone, and background work
  * answers no one.
  */
-export declare function listMembers({ env, for: target, }: ListMembersOptions): Promise<ListMembersResult>;
+export declare function listMembers({ env, for: explicitTarget, }: ListMembersOptions): Promise<ListMembersResult>;
 //# sourceMappingURL=listMembers.d.ts.map

package/dist/server/listMembers.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"listMembers.d.ts","sourceRoot":"","sources":["../../src/server/listMembers.ts"],"names":[],"mappings":"AAAA,OAAO,EAGL,KAAK,iBAAiB,EAEvB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAIL,KAAK,cAAc,EACpB,MAAM,kBAAkB,CAAC;AAK1B,MAAM,WAAW,kBAAkB;IACjC,8FAA8F;IAC9F,GAAG,EAAE,MAAM,CAAC;IACZ;;;;;;OAMG;IACH,GAAG,CAAC,EAAE,cAAc,CAAC;CACtB;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAsB,WAAW,CAAC,EAChC,GAAG,EACH,GAAG,EAAE,MAAM,GACZ,EAAE,kBAAkB,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAoBjD"}
+{"version":3,"file":"listMembers.d.ts","sourceRoot":"","sources":["../../src/server/listMembers.ts"],"names":[],"mappings":"AAAA,OAAO,EAGL,KAAK,iBAAiB,EACvB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAIL,KAAK,cAAc,EACpB,MAAM,kBAAkB,CAAC;AAS1B,MAAM,WAAW,kBAAkB;IACjC,8FAA8F;IAC9F,GAAG,EAAE,MAAM,CAAC;IACZ;;;;;;OAMG;IACH,GAAG,CAAC,EAAE,cAAc,CAAC;CACtB;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAsB,WAAW,CAAC,EAChC,GAAG,EACH,GAAG,EAAE,cAAc,GACpB,EAAE,kBAAkB,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAkBjD"}

package/dist/server/listMembers.js

@@ -1,8 +1,8 @@
 import { ConfigurationError, serviceRoutePath, } from "../internal/index.js";
-import { applyAttribution, checkAttribution, isRequest, } from "./attribution.js";
+import { applyAttribution, attributionFor, isRequest, } from "./attribution.js";
 import { getEveryAppUser } from "./everyApp.js";
-import { BINDING_ORIGIN } from "./gatewayFetch.js";
-import { GatewayRefusalError, gatewayRefusal } from "./integrationFetch.js";
+import { BINDING_ORIGIN, gatewayBinding, } from "./gatewayFetch.js";
+import { GatewayRefusalError, gatewayRefusal } from "./refusal.js";
 /**
  * The organization's members who can open the app now, through the
  * gateway's `members` capability: people deactivated, removed from the
@@ -19,10 +19,10 @@ import { GatewayRefusalError, gatewayRefusal } from "./integrationFetch.js";
  * for a request answers its signed-in user alone, and background work
  * answers no one.
  */
-export async function listMembers({ env, for: target, }) {
-    checkAttribution(env, target, "listMembers");
+export async function listMembers({ env, for: explicitTarget, }) {
+    const target = attributionFor(env, explicitTarget, "listMembers");
     const values = env;
-    const binding = values["EVERY_APP_GATEWAY"];
+    const binding = gatewayBinding(env);
     if (binding) {
         if (typeof binding.fetch !== "function") {
             throw new ConfigurationError("EVERY_APP_GATEWAY is configured but is not a valid service binding.");
@@ -48,7 +48,7 @@ async function listThroughGateway(binding, target) {
         throw new GatewayRefusalError({
             status: response.status,
             code: "members_list_failed",
-            message: `The Every App gateway answered ${response.status} to the members list.`,
+            message: `The EveryApp gateway answered ${response.status} to the members list.`,
         });
     }
     return (await response.json());
@@ -64,11 +64,8 @@ async function listInDev(env, target) {
                 id: user.id,
                 email: user.email,
                 name: "",
-                role: memberRole(user.orgRole),
+                role: user.orgRole,
             },
         ],
     };
 }
-function memberRole(role) {
-    return role === "owner" || role === "admin" ? role : "member";
-}

package/dist/server/refusal.d.ts

@@ -0,0 +1,55 @@
+/** What would make it work, as the Gateway words it. */
+export interface SetupInfo {
+    /** The Gateway settings it needs (`["DATAFORSEO_API_KEY"]`); `[]` when ready or not a setting. */
+    settings: readonly string[];
+    /** One sentence for a person, naming what to set and how; null when ready. */
+    setup: string | null;
+    /** The command an admin runs (`pnpm everyapp configure crm`), or null. */
+    command: string | null;
+}
+/** A refusal the AppGateway binding made itself, not the provider. */
+export interface GatewayRefusal extends SetupInfo {
+    status: number;
+    /** e.g. `capability_not_requested`, `integration_not_configured`. */
+    code: string;
+    message: string;
+}
+/** The refusal codes that mean no model is set up for the call. */
+export declare const AI_NOT_CONFIGURED_CODES: readonly string[];
+/**
+ * A refusal the AppGateway binding made, thrown: what `sendEmail()` throws
+ * when the gateway won't send (`email_sender_not_allowed`,
+ * `email_budget_exhausted`, ...). The thrown twin of {@link gatewayRefusal}.
+ */
+export declare class GatewayRefusalError extends Error implements GatewayRefusal {
+    readonly status: number;
+    readonly code: string;
+    readonly settings: readonly string[];
+    readonly setup: string | null;
+    readonly command: string | null;
+    constructor({ status, code, message, settings, setup, command, }: Pick<GatewayRefusal, "status" | "code" | "message"> & Partial<SetupInfo>);
+}
+/**
+ * The gateway's own refusal in `response`, or null when the response is the
+ * provider's answer (which may be an error of its own). Reads the body only
+ * for a refusal, so call it before reading the body yourself.
+ */
+export declare function gatewayRefusal(response: Response): Promise<GatewayRefusal | null>;
+/**
+ * The Gateway's refusal behind a thrown error, or null when it isn't one:
+ * a {@link GatewayRefusalError} (`sendEmail()`, `listMembers()`, `emit()`),
+ * an OpenAI SDK `APIError` or an ai-sdk `APICallError` for a call the
+ * Gateway refused (also inside ai-sdk's `RetryError` or an error's
+ * `cause`), or the SDK's local-development `ConfigurationError` for a
+ * missing key, which answers as the deployed refusal would
+ * (`ai_provider_not_configured`, status 503, the `.dev.vars` names).
+ */
+export declare function refusalFromError(error: unknown): GatewayRefusal | null;
+/**
+ * Whether `error` (or a refusal already read) means no model is set up:
+ * `ai_provider_not_configured` or `ai_default_not_configured`, from the
+ * Gateway or, in local development, from the SDK with no key in
+ * `.dev.vars`. Show `refusalFromError(error).setup` to the person.
+ */
+export declare function isAiNotConfigured(error: unknown): boolean;
+//# sourceMappingURL=refusal.d.ts.map

package/dist/server/refusal.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"refusal.d.ts","sourceRoot":"","sources":["../../src/server/refusal.ts"],"names":[],"mappings":"AAgBA,wDAAwD;AACxD,MAAM,WAAW,SAAS;IACxB,kGAAkG;IAClG,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAC;IAC5B,8EAA8E;IAC9E,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,0EAA0E;IAC1E,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;CACxB;AAED,sEAAsE;AACtE,MAAM,WAAW,cAAe,SAAQ,SAAS;IAC/C,MAAM,EAAE,MAAM,CAAC;IACf,qEAAqE;IACrE,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,mEAAmE;AACnE,eAAO,MAAM,uBAAuB,EAAE,SAAS,MAAM,EAGpD,CAAC;AAEF;;;;GAIG;AACH,qBAAa,mBAAoB,SAAQ,KAAM,YAAW,cAAc;IACtE,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAC;IACrC,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;gBAEpB,EACV,MAAM,EACN,IAAI,EACJ,OAAO,EACP,QAAa,EACb,KAAY,EACZ,OAAc,GACf,EAAE,IAAI,CAAC,cAAc,EAAE,QAAQ,GAAG,MAAM,GAAG,SAAS,CAAC,GAAG,OAAO,CAAC,SAAS,CAAC;CAS5E;AAED;;;;GAIG;AACH,wBAAsB,cAAc,CAClC,QAAQ,EAAE,QAAQ,GACjB,OAAO,CAAC,cAAc,GAAG,IAAI,CAAC,CAKhC;AAED;;;;;;;;GAQG;AACH,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,OAAO,GAAG,cAAc,GAAG,IAAI,CAWtE;AAED;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAGzD"}